cve/2023/CVE-2023-38817.md

### [CVE-2023-38817](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38817)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

** DISPUTED ** An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by Microsoft itself."

### POC

#### Reference
- https://ioctl.fail/echo-ac-writeup/

#### Github
- https://github.com/Whanos/Whanos
- https://github.com/hfiref0x/KDU
- https://github.com/kite03/echoac-poc
- https://github.com/pseuxide/kur